I have the same problem using Kepler SR1, mylyn 3.9.1 and bugzilla 4.4.1-1. However, I'm able to create new tasks. Mylyn also correctly refreshes changes done through the bugzilla web interface. Only updating from mylyn does not work for me.

It would be cool if someone could try to reproduce this, as I am not sure if its a bug or a faulty configuration on my machine. I wonder why mylyn sends out two requests to process_bug when I only click once on "submit" (see screenshot).

There is an old bug report where the same error appeared. However, the bug has been resolved so the cause must be something different this time. Still, the comments in the bug report might be helpful to understand for what the security token is for and how it works.